Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Transmission BitTorrent app contained malware

forum.transmissionbt.com

Post reply on HN
Print view View original

161–170 of 355 posts

Re: Transmission BitTorrent app contained malware

#161

Post by Amorymeltzer »

Matt3o12_ wrote: post #74

Can anyone tell me if this also applies to brew's cask's builds? I needed to download CentOS the other day and wanted to go with a torrent. I got pretty pissed after I realized that BitTorrent installed some adware called Spigot. I tried to remove it as good as possible (I mainly killed the process, removed `Library/Application Support/Spigot` and ran a `sudo find / | grep -i Spigot`). Ironically I decided to use the…

For anybody stumbling upon this, installation via homebrew-cask was _always_ safe[1] thanks to checksum verification. The caskfile has been updated to https[2] and version 2.92[3].

1: https://github.com/caskroom/homebrew-cask/issues/19504#issue...

2: https://github.com/caskroom/homebrew-cask/pull/19506

3: https://github.com/caskroom/homebrew-cask/pull/19508

Re: Transmission BitTorrent app contained malware

#162

Post by [deleted] »

SwellJoe wrote: post #50
justsaysmthng wrote: post #32

I've become increasingly paranoid lately, given that things like these happen and major bugs are uncovered in software that I use almost every day. It's good that the Transmission developer reacted quickly and made waves so that people can at least be aware that they might have been exposed.. But I wonder how many more applications from the hundreds that I have installed on my machines contain weird stuff - either in…

"Open source software is especially vulnerable to this kind of stuff." I'm not sure I follow on this front. Proprietary software could be compromised (whether intentionally by the vendor or unintentionally by some outsider working on the software) effectively forever with no one noticing. At least with OSS, the number of eyes on the source makes it less likely that an exploit will exist for long (though the definitio…

[deleted]

Re: Transmission BitTorrent app contained malware

#163

Post by arm »

microtonal wrote: post #59
microtonal wrote: post #48

Earlier quoted context omitted.

If a hacker gets access to a server holding the binaries for an open source app (which most people download), the hacker can just compile the program from sources and add his own code in there and place the installer online. Code signing is used to prevent this. So, either the attacker has an Apple developer account (and is hopefully traceable through their credit card information), the Transmission project was slopp…

So, either the attacker has an Apple developer account (and is hopefully traceable through their credit card information), the Transmission project was sloppy with their signing key, or the machine of the developer with the signing key was compromised. Sorry, I forgot another possibility: some other developer's key was compromised.

Or, as is the case here, the malicious party was simply issued a key by Apple (for apps that are downloaded from places other than the Mac App Store, developers can get a unique Developer ID from Apple (for free) and use it to digitally sign their apps, the purpose being that Apple can revoke it after the fact if it turns out to be malware):

“The two KeRanger infected Transmission installers were signed with a legitimate certificate issued by Apple. The developer ID in this certificate is “POLISAN BOYA SANAYI VE TICARET ANONIM SIRKETI (Z7276PX673)”, which was different from the developer ID used to sign previous versions of the Transmission installer. In the code signing information, we found that these installers were generated and signed on the morning of March 4.”

From: http://researchcenter.paloaltonetworks.com/2016/03/new-os-x-...

Re: Transmission BitTorrent app contained malware

#164

Post by jws »

Just an anecdatum: I got infected by this yesterday when I installed Transmission to download a Debian install CD. When I read about this at MacRumors I checked and had the kernel_service process running and the two hidden files hiding in Library.

I've unplugged and archived the TimeMachine backup disk and done the prescribed cleanup actions to remove he malware. I guess time will tell if it had any other tricks up its sleeve.

Re: Transmission BitTorrent app contained malware

#165

Post by Amorymeltzer »

orik wrote: post #98
Matt3o12_ wrote: post #74

Can anyone tell me if this also applies to brew's cask's builds? I needed to download CentOS the other day and wanted to go with a torrent. I got pretty pissed after I realized that BitTorrent installed some adware called Spigot. I tried to remove it as good as possible (I mainly killed the process, removed `Library/Application Support/Spigot` and ran a `sudo find / | grep -i Spigot`). Ironically I decided to use the…

My build from cask didn't start the process but force removed it anyways and am waiting for cask room to point towards 2.91.

homebrew-cask updated with version 2.92 and https

Re: Transmission BitTorrent app contained malware

#166

Post by Amorymeltzer »

finchisko wrote: post #107

Wondering if brew cask can be solution for this.

Inded, see my comment here: https://github.com/caskroom/homebrew-cask/pull/19508 Installation via brew cask was never at risk thanks to checksum verification, and at anyrate is now updated.

Re: Transmission BitTorrent app contained malware

#167

Post by [deleted] »

ikeboy wrote: post #99
snom380 wrote: post #90

Earlier quoted context omitted.

No, it's not true anymore. From the link you replied to: "On our production frontend machines, SSL/TLS accounts for less than 1% of the CPU load, less than 10 KB of memory per connection and less than 2% of network overhead. Many people believe that SSL/TLS takes a lot of CPU time and we hope the preceding numbers will help to dispel that." - Adam Langley, Google Getting an SSL certificate used to be a cost, but that…

So can you recommend a mirror for them that supports SSL? There are multiple named projects there that aren't using SSL, and I don't think it's just laziness. If you know of a way for them to use SSL mirrors for no additional cost, I'll work on getting them to switch over.

[deleted]

Re: Transmission BitTorrent app contained malware

#168

Post by 0x0 »

diebir wrote: post #152

This is a good illustration of why you should not install apps as administrator. Specifically, you should not install Mac OS packages, which allow for arbitrary pre- and post- install scripts to be executed as root. Same is true for Windows and Linux. There are privilege escalation bugs in any OS, but it is usually not a given. Throw the application into ~/Applications as a Mac bundle, worst that will happen is your…

I think it's a poor illustration. You could install and run this app as a regular user (and never escalate to administrator) and the app's bundled malware would still absolutely destroy anything of value on your computer.

It's the stuff inside $HOME (and $HOME/Documents) that's valuable. Not system binaries in {/bin,/sbin,/Applications} that can be re-downloaded in a second.

The problem is that any non-sandboxed app runs with the same uid and full read/write permissions to all of $HOME as well as all the other running processes, even if it only needs read/write access to $HOME/Documents/Appname/ and none of the other pids.

Re: Transmission BitTorrent app contained malware

#169

Post by conradev »

yeukhon wrote: post #148
ycmbntrthrwaway wrote: post #141

Earlier quoted context omitted.

> Jenkins probably contain the key to the svn server Why should it? For open-source software build-server can even be ran by a third party.

I am not following your comment here. Most Jenkins setup use global credentials or use the server-side config file like .ssh/config, .gitconfig link.

But ideally there are no credentials because Jenkins doesn't need to push code to the repo (and can clone the pubically available code).

Re: Transmission BitTorrent app contained malware

#170

Post by codehusker »

codehusker wrote: post #154
ikeboy wrote: post #99

Earlier quoted context omitted.

So can you recommend a mirror for them that supports SSL? There are multiple named projects there that aren't using SSL, and I don't think it's just laziness. If you know of a way for them to use SSL mirrors for no additional cost, I'll work on getting them to switch over.

Debian, Ubuntu, Qubes, and others are on https://mirrors.kernel.org . I suspect that wiki page you linked might be out of date. It seems like all of the Whonix download links on their website are over https, like the VirtualBox images https://www.whonix.org/download/12.0.0.3.2/Whonix-Workstatio... . Whonix also runs a tor mirror, which has significantly more overhead than TLS.

I know the last time I played with Whonix it was http, so I think you're right that it's a recent change.

For tails: https://tails.thecthulhu.com/. It appears to be the same server behind http://dl.amnesia.boum.org/ based on the TLS cert.

The situation is messy to actually use https for all of these projects, but I think the issue now is organization rather than overhead.

Post reply on HN